Problem booting back into Win2K after running Knoppix

**P4p4Psm3rph** · 12-25-2003, 07:28 PM

I've run Knoppix for the first time on my Win2K machine. Now I can't boot back into Win2K (only Safe Mode works).

Has anyone else had a similar problem and knows of a fix?

Symptoms:
1) POST completes.
2) See large Windows 2000 screen with scrolling bar.
3) See Windows 2000 desktop with dialog "Windows is starting up...".
4) Computer reboots!

Attempted Fixes:
1) Run ChkDsk /r to check and repair all disks in Recovery Console.
2) Enable boot logging. Examing C:\WINNT\ntbtlog.txt. Shows "Loaded driver \??\C:\WINNT\System32\vsdatant.sys" as the last line. This is the ZoneAlarm device driver.
3) Reinstalled ZoneAlarm with "Clean Install" option.

Thoughts:
1) I haven't run FixMBR from the Recovery Console because I don't think the MBR is corrupt (or wouldn't be loading Win2K as far as it does).
2) I'm thinking of just reformatting and reinstalling Win2K along with a real Linux distro (I'm also interested in creating an LFS system).

Any thoughts or similar problems?

Thanks and Merry Christmas!

**Markus** · 12-25-2003, 08:08 PM

Hi,

You didn't say if you've written on an NTFS disk from linux?
If that's the case, you could try with ntfsfix, see $man ntfsfix
It's a bit risky though as all ntfs thingies in linux.

BTW, have you scanned for viruses? Some of them try to kill virus-scanners and firewalls and generally mess things up

**popuman** · 12-25-2003, 08:08 PM

I do have w2k and all the updates in my sistem. did the knoppix-hdinstall script, loaded LILO into the MBR with no problems. that's weird.

**P4p4Psm3rph** · 12-25-2003, 08:16 PM

I don't think I have any viruses. My system is pretty clean and I keep track on all open ports, etc. ZoneAlarm was working flawlessly before I tried Knoppix. If its a virus, then it either came from Knoppix or was delivered while running Knoppix. Also, I didn't install Knoppix, I just ran it from the CD ISO. Does the Knoppix base present any exploitable interfaces?

My drives are NTFS. I didn't write to them or change their configuration while running Knoppix. I did view them in the Knoppix GUI file explorer.

Basically, I was interested in seeing what a Linux OS would look like. Got the Knoppix ISO, burned it, and rebooted. It booted just fine! Played around for about 10 minutes. Ejected the CD and rebooted to find Win2K busted.

Well, I'm generally an optimist so it seems like a good time to reinstall Win2K and then look into dual booting into Linux and (hopefully) my own LinuxFromScratch system.

**Markus** · 12-25-2003, 08:45 PM

Hmm,

You might as well try pressing F8 and choosing "Last known good configuration"
And why not "fixmbr" and "fixboot" from recovery console, although I don't think you'd get that far if you didn't have broken files somewhere.
Have you tried the "Repair" option from the win install CD.

**Cuddles** · 12-25-2003, 11:56 PM

P4p4Psm3rph,

Interesting...

I know for a fact that the Knoppix Live CD couldn't have "picked up" a virus - even if you managed to get to the internet, because it runs strictly on a RamDisk, which it creates during each boot. So, if a virus was picked up, it would simply evaporate when you shutdown. Assuming the ISO was flawed, I would think you wouldn't be able to boot Knoppix. From what I hear, "looking" at NTFS disks is fine, but touching them, editing and saving, is a bad thing, it can cause file/disk corruption - which is mentioned in these forums "many" times. This is also the reason why Knoppix DEFAULTS to read-only on any drives it detects, when booted from the CD.

Even if Knoppix did pick up a virus, it would have to be a virus "specific" to Linux/Debian/Unix, and since booting into a OS that is not Unix is by far, a different breed, shouldn't be able to "cross-platform" OS's. A MAC virus can not infect a PC, for this same reason, a PC virus can not infect a Unix/Linux. Assuming they don't have "same" file systems. Since you are running a NTFS file system in Win2k, and Knoppix is not only using a RamDisk, but also uses a Linux FS, they are not cross-platform.

Only thing I can think of is that (knowing M$) it saw you going behind its back, and trying another (competition) OS, and it got mad at you. [ j / k and sorry, I couldn't resist ]

Knoppix was made on the CD so that it "wouldn't" touch your OS, it runs without having to use, or take, anything away from your "already" working OS. It is even safe-gaurded, by not allowing WRITE access, by default, to existing drives on your system. Only thing I could think of is that: Did you do a "Save Knoppix Configuration", or a "Create Persistant Knoppix Home", or "Create Knoppix Swap File" - and if so, did those things get placed on your Win2k hard drive?

Just some ideas,
Cuddles

**P4p4Psm3rph** · 12-26-2003, 05:13 AM

Cuddles,

LOL Yeah, M$ disabled their own OS..?!

Thanks for all the advice. I think I'm just gonna rebuild my system. At least I have two hard drives and can boot into safe mode. I've already made a backup CD and moved some larger sets of files to the other drive.

Thanks for your extensive reply also.

Peace!